Hi @jsturtevant. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

@liggitt should take a look at this as well. LGTM
/assign @liggitt

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jsturtevant
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: liggitt

If they are not already assigned, you can assign the PR to them by writing /assign @liggitt in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

There is more discussion happening for this feature at kubernetes/enhancements#799. The consensus from the sig-windows meeting this morning was to push this feature out to 1.15 and go through the KEP process. Putting this issue on hold until that is submitted and approved.

/hold

The commits here are a working prototype and I was able to verify using these yaml files. A sample yaml file as it is currently prototyped would have a security context that looks like:

    spec:
      containers:
      - name: sc-customuser
        image: stefanscherer/whoami:windows-amd64-1.8.2-1809 
        securityContext:
          windowsOptions:
            runAsUserName: ContainerUser

You can validate by exec into the container and running:

kubectl exec -it sc-customuser-6799b77b6d-sfckq cmd
Microsoft Windows [Version 10.0.17763.253]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\>echo %username%
ContainerUser

cc: @PatrickLang @michmike

/sig windows

@jsturtevant: PR needs rebase.

@PatrickLang are this and #75459 being combined? wanted to make sure I was looking at the right PRs and that they were ready for review

we're combining these at least into 1 KEP to cover the full WindowsSecurityContext API addition. I'm not 100% yet whether it will be 2 PRs or 1.

Combined KEP for GMSA + RunAsUsername fields: kubernetes/enhancements#972

@ddebroy @PatrickLang

wanted to check in on this... do we want #75459 to land before starting review on this, or is this ready to do in parallel?

@liggitt @PatrickLang @jsturtevant I think we can review this in parallel and rebase with #75459 if needed. It will be great if @jsturtevant can rebase this on #77147 first since that has been merged.

It will be great if @jsturtevant can rebase this on #77147 first since that has been merged.

agreed. can you do that first?

/ok-to-test

@jsturtevant: The following tests failed, say /retest to rerun them all:

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

A couple of things that need to be added from a API review perspective:

1. We agreed on minimal length validation for the field. Please add the corresponding check (+ unit test) in validateWindowsSecurityContextOptions in pkg/apis/core/validation/validation.go

2. I think we need a feature flag associated with RunAsUsername along with a corresponding entry in dropDisabledFields (+ unit tests) to prevent users from setting the field if not explicitly enabled.

Update on this PR: it will be postponed to v1.16 based on an update from Patrick.

This was discussed in an API review with @liggitt , and we have the recommended final name in https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md

Here's an example

apiVersion: v1
kind: Pod
metadata:
  name: iis
  labels:
    name: iis
spec:
  securityContext:
    windowsOptions:
      gmsaCredentialSpecName: webapp1-credspec
      runAsUserName: "NT AUTHORITY\\NETWORK SERVICE"
  containers:
    - name: iis
      image: mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2019
      ports:
        - containerPort: 80
    - name: logger
      image: eventlogger:2019
      ports:
        - containerPort: 80
  nodeSelector:
    beta.kubernetes.io/os : windows

cc @BCLAU